Critical SonicWall Vulnerability Exploited Days After Disclosure

1. Executive summary

SonicWall patched four vulnerabilities in its Secure Mobile Access (SMA) 1000 appliances on 2026-10-07, including CVE-2026-102255, a pre-authentication server-side request forgery flaw rated CVSS 10.0 CRITICAL. At patch time the vendor stated it had no evidence of exploitation in the wild; reporting on 2026-10-12 states the flaw is now being exploited, days after disclosure. The affected appliances are remote-access gateways, so a pre-auth SSRF that reaches internal functionality sits directly in front of the corporate network. CVE-2026-102255 is not in CISA KEV and carries an EPSS score of 0%, so prioritisation rests on the CVSS 10.0 rating, the pre-auth reachability, and the reported exploitation rather than on any exploitation-probability feed. EMEA financial services clients running SMA 1000 appliances exposed to the internet should treat this as a P1 patch.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	A CVSS 10.0 pre-auth flaw in an internet-facing remote-access gateway is reported as exploited days after disclosure, so detection and response must run against a live exploitation window, not a theoretical one.	Clients must be able to detect, log and manage an incident on the SMA 1000 appliance itself; if the appliance is the compromised asset, incident handling cannot rely on it as a trusted sensor.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If the appliance is compromised, the incident may meet the major-incident threshold and trigger a reporting clock.	Confirm whether compromise of the SMA 1000 meets the client's major-incident classification before the reporting window closes; the classification decision is time-bound.
NIS2 Art. 21(2)(d): supply chain security measures	The exposure is in a third-party remote-access product, and the fix is a vendor hotfix that clients must track and apply.	Clients must be able to evidence that vendor security updates for the SMA 1000 are tracked and applied within their supply chain controls.

3. Technical analysis & attack chain

CVE-2026-102255 is a server-side request forgery vulnerability in SonicWall SMA 1000 series appliances. It is pre-authentication: an attacker does not need a login to reach it. The verified reference data classifies it as CWE-441 (Unintended Proxy or Intermediary) and CWE-918 (Server-Side Request Forgery), CVSS 10.0 CRITICAL, not in CISA KEV, EPSS 0%.

The confirmed mechanism, from the vendor description carried in reporting: a remote unauthenticated attacker can direct the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations. The appliance is the intermediary. The attacker's requests originate from the appliance, which is why the flaw reaches internal services that are not themselves internet-exposed.

Confirmed steps:

The attacker reaches the SMA 1000 appliance's pre-authentication interface. No credentials are required.
The attacker supplies a request that the appliance processes on their behalf, causing it to issue requests to a location the attacker chooses.
Those requests reach internal functionality that the appliance can address but the attacker cannot reach directly.
The attacker performs unauthorized operations through that internal reach.

The source material does not describe post-exploitation behaviour for CVE-2026-102255: no payload, no persistence mechanism, no command-and-control, no lateral-movement technique, no exfiltration method and no observed impact are given. Do not assume any. What the reporting establishes is that exploitation is occurring; it does not establish what the attacker does after the SSRF succeeds.

Two related CVEs on the same product line are in CISA KEV and are relevant context for anyone triaging SMA 1000 exposure, though neither is the CVE in this advisory:

CVE-2026-15409, SonicWall SMA1000 Appliances SSRF, remote unauthenticated attacker can cause the appliance to make requests to an unintended location. KEV due date 2026-07-17. Ransomware campaign use: Unknown.
CVE-2026-83548, SonicWall SMA1000 Appliances SSRF, remote unauthenticated attacker can gain unauthorized access to sensitive functionality and perform unauthorized operations. KEV due date 2026-09-05. Ransomware campaign use: Unknown.

Both KEV entries describe SSRF on the same appliance class as CVE-2026-102255. The KEV remediation due dates for those two CVEs have already passed, which means any SMA 1000 appliance still carrying them is overdue, independent of this advisory.

Confidence caveats. The exploitation claim for CVE-2026-102255 rests on the primary item, a single news report dated 2026-10-12; the vendor's own position as of the 2026-10-07 patch was that it had no evidence of exploitation. Treat the exploitation as reported but single-sourced, and verify against your own appliance logs before treating it as confirmed in your environment. The CVSS 10.0 rating and the CWE classification are from the verified reference data. The source text for the primary item is thin: it states the flaw is a pre-authenticated SSRF that could allow unauthorized operations and that exploitation is occurring. It does not name an exploiting actor, a campaign, or a toolset. No attribution is made here, and none should be inferred.

4. Mitigation & containment

P1, within 24 hours:

Apply the SonicWall hotfix for the SMA 1000 series released 2026-10-07, which addresses CVE-2026-102255 and the three other flaws in the same release. This is the primary remediation; the vendor fix is the only remediation named in the source material.
If the appliance cannot be patched immediately, remove it from internet exposure. The flaw is pre-authentication, so access controls on the login path do not mitigate it.
Check whether the appliance carries CVE-2026-15409 or CVE-2026-83548. Both are in CISA KEV with due dates of 2026-07-17 and 2026-09-05 respectively, both already passed. If either is present, the appliance is overdue on a known-exploited flaw and should be treated as a higher-priority patch than CVE-2026-102255 alone.
Preserve appliance logs before patching or rebooting. If the appliance is compromised, the logs are the only record of the SSRF requests it issued, and a reboot may lose volatile state.

P2, within 72 hours:

Review SMA 1000 logs for outbound requests the appliance issued to internal addresses it has no legitimate reason to contact. The SSRF mechanism means the appliance is the source of the malicious requests, so the observable is appliance-originated traffic to internal destinations, not inbound attacker traffic.
Review authentication and session records on the appliance for activity that does not correspond to a known user, on the assumption that reaching internal functionality may have led to unauthorized operations.
Confirm whether the appliance's management interface and any internal services it can reach are segmented from the rest of the network. If the appliance can address internal functionality broadly, the SSRF reach is correspondingly broad.

P3, within 7 days:

Inventory all SMA 1000 appliances, including any not currently internet-facing, and confirm patch state against the 2026-10-07 release.
Confirm that vendor security updates for the SMA 1000 are covered by the client's third-party risk process, so the next hotfix is tracked rather than discovered.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources name no hashes, domains, IP addresses, file paths, registry keys or command lines for CVE-2026-102255. The exploitation is reported but no atomic indicator of it is published in the material provided. Do not populate detection tooling with invented values.

Behavioural indicators, from the described mechanism:

behaviour	where to observe	confidence
The SMA 1000 appliance issues requests to internal destinations it does not normally contact	Appliance egress logs, firewall logs for traffic sourced from the appliance	Medium; derived from the SSRF mechanism, not from a published observation
Pre-authentication requests to the appliance that result in the appliance making a subsequent outbound request	Appliance access logs correlated with egress logs	Medium; derived from the pre-auth nature of the flaw
Unauthorized operations performed through internal functionality reached via the appliance	Logs of the internal services the appliance can address	Low; the source does not describe what operations were performed

These are behavioural, not atomic. They belong in log review and correlation, not in the copyable block.

6. Detection

Insufficient indicators to author detection rules.

The source material contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, ransom-note text or hard-coded values for CVE-2026-102255. The only artefacts available are the CVE identifier, the product name and the vendor's description of the flaw, none of which are artefacts of the threat itself. A rule built from those would match reporting about the vulnerability, not exploitation of it. Detection for this item has to run on the behavioural indicators in §5, in appliance and firewall log review, until a vendor or incident-response source publishes atomic indicators.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-102255	10.0 Critical	—	0%	A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate acc…

7. Sources

SecurityWeek, Critical SonicWall Vulnerability Exploited Days After Disclosure, https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/, 2026-10-12.
Help Net Security, SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255), https://www.helpnetsecurity.com/2026/10/07/sonicwall-fixes-pre-auth-ssrf-flaw-in-sma-1000-appliances-cve-2026-102255/, 2026-10-07.
The Hacker News, SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances, https://thehackernews.com/2026/10/sonicwall-patches-cvss-100-pre.html.
The Hacker News, Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands, https://thehackernews.com/2026/07/two-sonicwall-sma-1000-zero-days.html.
NVD / CISA KEV, CVE-2026-15409, https://nvd.nist.gov/vuln/detail/CVE-2026-15409.
NVD / CISA KEV, CVE-2026-83548, https://nvd.nist.gov/vuln/detail/CVE-2026-83548.
ANSSI CERT-FR, Multiples vulnérabilités dans Sonicwall Secure Mobile Access 1000, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0875/, 2026-07-15.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-102255 as CVSS 10.0 CRITICAL, not in CISA KEV, EPSS 0%, with exploitation reported by a single source on 2026-10-12 and no actor attribution available in the material. The severity is driven by the pre-authentication reach and the position of the SMA 1000 as a remote-access gateway, not by any exploitation-probability feed; the EPSS score of 0% should not be read as a reason to deprioritise. The exploitation claim is single-sourced and the vendor's position at patch time was that it had no evidence of exploitation, so clients should verify against their own appliance logs rather than assume compromise. We will track for a vendor confirmation of exploitation, for any published atomic indicators, and for the patch state of the two KEV-listed SMA 1000 SSRF flaws whose remediation due dates have already passed, and we will reissue this advisory if atomic indicators or an attribution emerge. Clients running internet-facing SMA 1000 appliances should confirm patch state against the 2026-10-07 hotfix and report back to their Adverse Trace contact within 24 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.